Venom RAT has been updated with a stealer module that exfiltrates sensitive data to its C2 server, expanding its malicious capabilities. The malware now steals browser data, passwords, cookies, history, and even credit card details, while threat actors offer Venom with pricing plans and bulletproof VPS services for deployment.
#VenomRAT #VenomStealer
#VenomRAT #VenomStealer
Keypoints
- Venom RAT’s latest version adds a stealer module that collects sensitive information and exfiltrates it to the attacker’s C2 server.
- Old Venom RAT already offered remote access, HVNC, keylogging, and other capabilities; the new version extends these with a dedicated stealer and in-memory module loading.
- The Recovery (Stealer) module targets data from more than 20 browsers (e.g., 360browser, Chromium, Opera, Comodo Dragon, 7Star).
- The stealer searches for keywords related to banking, cryptocurrency, and pornography in local artifacts (bookmarks, cookies, downloads, histories) to fetch domain names.
- Credit card data (Cardholder Name, Number, Expiry) can be stolen using a regex-based approach and are written as JSON to the C2 server.
- Persistence and evasion techniques include disguising as svchost.exe, creating a scheduled task, dropping a BAT file, and loading modules in memory (Recovery, Keylogger, etc.).
- The threat actor ecosystem around Venom includes VPS/bulletproof services and pricing details, underscoring commercialized deployment of the malware.
- Defensive recommendations emphasize email security, up-to-date AV, blocking untrusted sources, MFA, regular backups, DLP, and periodic audits and vulnerability assessments.
MITRE Techniques
- [T1204] User Execution – The initial infection may occur via spam email… “The initial infection may occur via spam email, so enterprises should use email-based security to detect phishing emails.”
- [T1105] Ingress Tool Transfer – The stealer exfiltrates stolen data to the C&C server, indicating data transfer to attacker infrastructure.
- [T1071] Application Layer Protocol – Data is sent to the C&C server using application-layer channels; the malware writes stolen data into JSON and transmits it to the C&C server.
- [T1053] Scheduled Task/Job – Persistence via a scheduled task created with schtasks to run on logon:
schtasks /create /f /sc onlogon /rl highest /tn “svchost” /tr ‘“C:Users<Admin>AppDataRoamingsvchost.exe”’ - [T1036] Masquerading – Drops a copy of itself into %appdata% named “svchost.exe” to masquerade as a legitimate file.
- [T1562] Disable or Modify Tools – Disabling Windows Defender as part of defense evasion.
- [T1497] Virtualization/Sandbox Evasion – Anti-kill (prevents termination of the RAT client), mutex creation, startup persistence, icon changes, etc.
- [T1056] Input Capture – Remote Keylogger functionality.
- [T1005] Data from Local System – Stealer fetches data from local browser artifacts (passwords, cookies, bookmarks, histories, autofill).
- [T1082] System Information Discovery – Collecting system information as part of discovery.
- [T1057] Process Discovery – Used to understand running processes on the host as part of reconnaissance.
- [T1005] Data from Local System – Data from local files (bookmarks, cookies, downloads, histories) used to identify domains.
- [T1059] Command and Scripting Interpreter – Execution of commands and scripts (e.g., remote shell, PowerShell) as part of operations.
- [T1047] Windows Management Instrumentation – HVNC and remote control capabilities may leverage Windows management interfaces to operate; used for remote control aspects described in Venom’s capabilities.
Indicators of Compromise
- [File] svchost.exe – dropped into AppDataRoaming as a masquerade file to establish persistence. Example: “svchost.exe” (masquerade as legitimate file)
- [File] tmp61C0.tmp.bat – dropped in %temp% and used to run the dropped svchost.exe, then deletes itself
- [JSON] Stolen data payload – assembled into JSON format before transmission to C&C
- [Hash – MD5] 0ee108a8e3b9cddad2cceb2648072fe2; eeb4af560710c06455f846a1e3eef0de
- [Hash – SHA256] 4672ceafd2e11ff9aa26ecbb9094aed5d1a58e995f2a93ae054f46f6f56591f7; 1e3ace568ea7584bf49c4e9d32ec3d2a1bb917742052d5fe4b1a0adea7470003; f45d96223b4ef0023b6b223210bd7c83e46bfc05f1e9c24cea34db7574943d30
- [Hash – SHA256] 66c2b9e27a9a971df37c45652896967118daaa38bd2915532c2663d3079a0d92 (Venom Client executables)
Read more: https://blog.cyble.com/2022/12/13/venom-rat-expands-its-operations-by-adding-a-stealer-module/